Privacy Policy

1. Applicable Laws

MediShields handles PHI and other personal data as a Business Associate under HIPAA and in compliance with the following laws and regulations, as applicable to the client, patient, or visitor whose data we process:

• HIPAA Privacy Rule: 45 CFR Part 160 and Part 164, Subparts A and E
• HIPAA Security Rule: 45 CFR Part 164, Subpart C
• HITECH Act Breach Notification Rule: 45 CFR §§ 164.400–414
• General Data Protection Regulation (GDPR): for clients or patients located in the European Union
• California Consumer Privacy Act (CCPA/CPRA): for California residents
• State privacy laws: including Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other applicable state statutes
• PCI DSS: for payment card data processed on behalf of clients

2. Data We Collect

We collect the categories of information below. Each category is processed under a specific legal basis, typically a Business Associate Agreement (contract) with the provider, a legal obligation (e.g., claims submission, compliance reporting), or your consent (e.g., website cookies).

3. How We Use Your Data

We use the data described above to:

1. Submit and manage medical claims and billing on behalf of provider clients
2. Complete provider credentialing and payer enrollment
3. Maintain compliance with HIPAA, payer, and regulatory requirements
4. Provide virtual medical scribing and documentation services
5. Generate reporting and analytics dashboards for provider clients
6. Respond to support requests and provide customer service
7. Meet legal obligations, including responding to lawful requests from authorities
8. Improve and secure our services, systems, and website

We do NOT sell PHI or personal data, use it for advertising or marketing to patients, or use it for unrelated research or product development without explicit authorization.

4. Data Protection & Security

We maintain administrative, physical, and technical safeguards designed to protect PHI and personal data, including:

• Encryption: AES-256 encryption for PHI at rest, and TLS 1.2 or higher for data in transit^†
• Access control: role-based access control and multi-factor authentication (MFA) required for all systems containing PHI^†
• Monitoring: continuous system monitoring for unauthorized access or unusual activity^†
• Security testing: regular vulnerability scans and periodic third-party penetration testing^†
• Documented incident response procedures for suspected or confirmed security events
• Business Associate Agreements (BAAs) with all subcontractors and vendors who access PHI, per 45 CFR § 164.504(e)

^† Reflects standard practice for a HIPAA Business Associate; not yet confirmed against MediShields’ actual implementation.

5. Data Sharing & Vendors

We share data only as necessary to deliver our services, and only with parties bound by a signed Business Associate Agreement or equivalent contractual data-protection terms. This includes:

• Insurance companies and payers, for claims submission and processing
• EHR and practice management system vendors, for data integration
• Payment processors, for handling billing and reimbursement transactions
• Clearinghouses, for claims routing and validation
• Regulators and law enforcement, when legally required

We do NOT sell data to marketers or any third party for advertising purposes.

6. Your Rights

To submit a request under any of the rights above, contact our Privacy Officer using the details in Section 12. We will respond within 30 days for HIPAA and GDPR requests, and within 45 days for CCPA requests, as required by applicable law.

7. Breach Notification

A breach is an impermissible use or disclosure of unsecured PHI that compromises its security or privacy. In the event of a breach, we follow this process:

1. 1. Discovery: the incident is identified and logged
2. 2. Investigation: scope, cause, and affected individuals are determined
3. 3. Notification: affected individuals and clients are notified, including what happened, what data was involved, what individuals should do, and our contact information
4. 4. Regulatory reporting: HHS Office for Civil Rights and applicable state regulators are notified as required
5. 5. Remediation: corrective actions are taken to prevent recurrence

Notification is provided without unreasonable delay and no later than 60 days after discovery, as required by the HITECH Breach Notification Rule.

8. Data Retention

• PHI: retained per applicable state medical records requirements, generally 6–10 years depending on the client’s state of practice and patient age (minors’ records may be retained longer under state law)^†
• Financial and billing records: retained for 7 years
• Website cookies and technical data: retention varies by cookie type; see Section 9

At the end of the applicable retention period, data is securely destroyed or de-identified in accordance with HIPAA disposal requirements.

^† Reflects standard practice; exact retention period should be confirmed per client state requirements before publishing.

9. Cookies & Tracking

Our website uses cookies and similar technologies to operate essential site functionality, remember preferences, and understand aggregate site usage. You can control cookies through your browser settings. We do not use cookies to track patients or PHI.

10. Children’s Privacy

Our website is not directed at children under 13, and we do not knowingly collect personal information from children through our website. PHI relating to minor patients is handled by our provider clients in accordance with HIPAA and applicable state law, and is processed by MediShields solely as a Business Associate on their behalf.

11. Changes to This Policy

We may update this Privacy Policy periodically. Non-material changes (e.g., formatting, clarifications) take effect immediately. Material changes, such as new categories of data collected, new purposes of use, or new third-party sharing, will be posted with an updated effective date at least 30 days before taking effect.

This policy is reviewed at least annually and whenever applicable laws change.

12. Contact Us